Privacy / Draft for review
Your data.
Your choices.
Draft prepared: 5 September 2026 · Effective date to be set at public launch
This notice covers the Novak Works informational website, business enquiries and the current private My Workout Plan prototype. It does not govern the separate Obračun application. The application currently has one private user and does not offer public account registration. The Garmin integration is not active. The planned integration described below is not a statement that Garmin data is already being collected.
1. Who is responsible
The operator and contact for this project is Jan Novak s.p., Slovenia. Contact Jan Novak at jan@novakworks.si. The intended public website is https://novakworks.si/. This version is a private preview.
2. Website and business enquiries
The Novak Works pages do not include contact forms, advertising, analytics, external fonts or third-party images. Viewing these pages does not upload training data. The hosting service processes the request information necessary to deliver and protect the pages.
If you send an email about grip work or an application, the operator receives your address and any information you choose to provide. This is used to respond to your enquiry and, where relevant, take steps towards the work you request. General correspondence is handled in the legitimate interest of managing business communications. Applicable invoicing and record-keeping duties are handled separately when a business relationship is established.
3. Data used by the current prototype
| Data | Purpose and handling |
|---|---|
| Athlete profile | Manually entered FTP, maximum heart rate, lactate-threshold heart rate and weight are saved in this browser's local storage to calculate workout targets and planning guidance. |
| Saved daily plans | The prototype keeps up to seven saved plan entries in this browser's local storage so the user can revisit recent plans. |
| Imported course files | Files may contain coordinates, elevation, names and timestamps. They are processed in browser memory; the current file-import feature does not upload them to an application server. Generated downloads are saved to the user's device and remain there until the user removes them. |
| Access and technical information | The hosting and access services process requests needed to deliver and protect the application, which may include account information, IP address and technical request metadata. Connection endpoints receive the authenticated account email when access is available. |
| Support correspondence | Information voluntarily sent to the contact address is used to respond and manage the request. |
4. Purposes and legal basis
Data is used to provide the functions requested by the user, preserve chosen settings and respond to support requests. Necessary technical access and security processing serves the legitimate interest of operating and protecting the service, subject to the user's rights. Before extending the current owner-only prototype to other users, the operator will establish and communicate the applicable service terms and legal basis for each processing purpose.
Before enabling Garmin health-data collection or collecting another person's sensitive health data, the application will provide specific information about the data and purposes and obtain explicit consent where required. Garmin account authorization will not be treated as a substitute for the application's own health-data consent requirements. The current prototype is not open for such collection from the public.
5. Local storage, cookies and external requests
The application uses local storage entries named athlete-profile and momentum-history. These persist until the user clears the site's browser data or the application overwrites them. Clearing them removes the local profile and saved plans; it does not remove files already downloaded to the device.
The OAuth scaffold uses short-lived secure, HttpOnly cookies for an authorization attempt, with a configured lifetime of ten minutes. The flow is not available until the Garmin integration is configured and validated. The hosting service may use separate access/session cookies governed by its notice.
The application's map view requests tiles from OpenStreetMap. These requests disclose the IP address and requested map tiles to that service and may reveal the viewed map area. They do not transmit the complete imported file. See OpenStreetMap Foundation's privacy policy.
The supplied informational website pages contain no analytics scripts, tracking pixels, advertising or forms. Hosting infrastructure may still process necessary request information.
6. Service providers and international processing
The Vercel version of this informational website is hosted by Vercel. The existing ChatGPT Sites preview is hosted through ChatGPT Sites. The My Workout Plan application uses ChatGPT Sites with Cloudflare runtime/database services. OpenStreetMap supplies map tiles. The business-email hosting provider processes correspondence sent to jan@novakworks.si. Provider details and applicable processing arrangements will be confirmed before public launch. Each service may process information according to its role and applicable terms.
The operator has not verified an EEA-only processing location and does not promise EEA-only storage. Before new server-side Garmin data collection or opening access to other users, the operator will verify the processor agreements, actual processing locations and applicable safeguards for transfers outside the EEA, and update this notice with the relevant details. No unverified transfer certification is claimed here.
7. Retention and deletion in the current prototype
Imported files stay in the current browser session and are cleared on reload. Local profile settings and plan history remain in the browser until cleared; plan history is capped at seven entries, not a fixed number of days. Downloaded files remain under the user's control. Support correspondence is kept while needed to handle the request and any applicable legal obligations; unnecessary correspondence will be removed through periodic review.
Hosting and access-service log retention is controlled by the actual service configuration and provider terms; the application does not claim an unverified deletion period for provider logs or backups. There is currently no active Garmin synchronization. Server-side Garmin data retention, account deletion, consent withdrawal and backup handling must be implemented and stated here before that processing is enabled.
8. Planned Garmin integration
Subject to Garmin approval and user permission, the intended integration will use supported completed activities and selected health summaries for training, recovery and nutrition planning, and send the user's selected workouts/courses to Garmin. The precise data types will be limited to the approved APIs and the functions actually used. Availability of FTP, HRV Status, Body Battery and Training Readiness has not been guaranteed.
The application will use official Garmin authorization and will not request the user's Garmin password. The existing foundation includes server-side encrypted token storage. Data ingestion, token refresh, disconnection, revocation, explicit health consent, server-side deletion and retention controls remain to be completed and tested before activation.
The current application code does not sell personal data, embed advertising or send athlete data to an external AI-model API. Any future change to recipients or purposes requires an updated notice and appropriate legal basis and permissions.
9. Your choices and rights
You can use the prototype without connecting Garmin and can clear local application data in your browser. Contact jan@novakworks.si to ask about access, correction, deletion, restriction, objection or portability where applicable. You may withdraw consent at any time where processing relies on consent; this does not affect earlier lawful processing. The operator may request proportionate information to verify a requester's identity. Requests will normally be answered within one month. If a lawful extension is needed, the requester will be informed within that month.
You may complain to a relevant supervisory authority. In Slovenia this is the Information Commissioner.
10. Guidance, audience and changes
Workout and wellness outputs are suggestions the user may accept, edit or ignore. The current application makes no automated decisions with legal or similarly significant effects and is not a medical diagnostic service. The current prototype is intended for its adult operator, not children. This notice will be updated when processing changes, and the revised date will appear above. Material changes will be communicated before the corresponding collection or use begins.